UCF students have introduced a new way for future cyber professionals to develop the hands-on cyber skills they’ll need in their careers. Horse Plinko, a live cyberattack-simulation contest named after a meme of a horse falling through a plinko board, has exploded in popularity since its introduction last year.

Organizers hosted its second Horse Plinko Cyber Competition this month, attracting more than 160 competitors.

The contest with the silly name offers serious experience for anyone interested in cyber defense. Participants role-play as cybersecurity interns who defend a fictional company, the International Horse Plinko League, from various cyberattacks. During the six-hour competition, “plinkterns” are tasked with three priorities: identifying threats, bolstering defenses to keep the threats from returning, and keeping the company’s critical services up and running in real time.

“We simulate a business network for teams to defend and pit them against live attackers attempting, and succeeding, to hack into their network,” says competition director Harrison Keating ’24, a cybersecurity and privacy master’s degree student and captain of UCF’s Collegiate Cybersecurity Competition (C3) team. “That’s an experience many of them will not get again until they are working in the field.”

One of the big draws to Horse Plinko is the levity its organizers have weaved into the event. The contest underscores the valuable hands-on experience it offers with a healthy dose of fun.

“We have a LinkedIn profile and website for the fictional company, there’s recurring characters that appear in-person during the competition, and there are a lot of running jokes,” Keating says. “Keeping it light-hearted helps make the competition more approachable to new students.”

He adds that Horse Plinko is structured to mimic a real-world environment not just in terms of the technical skills required of future cyber professionals, but for the interpersonal skills needed as well.

“Cybersecurity is a highly collaborative field, and this is a good chance for them to develop their teamwork and communication skills in a high-pressure environment,” Keating says. “It also helps students network with their peers and learn from each other.”

With several dozen competitions under their belts — including a recent National College Cyber Defense Competition (NCCDC) championship — organizers have a wealth of experience to draw upon to develop and run the event. They intend to bring cyber skills to the masses with a contest designed to be accessible to anyone with an interest in cyber, no matter the major or skill level.

“Our club has over 350 members, and only eight of them get to compete in the National CCDC,” says Keating. “Our mission is to provide that kind of quality learning experience to as many students as possible.”

Keating says live contests like these aren’t widely available to students because of the infrastructure and manpower required to run them. Horse Plinko, however, is supported by hundreds of members from the C3 team and Hack@UCF. Previous Horse Plinko competitors returned to help run the next event, bringing their ideas and experience to a new batch of plinkterns.

“It enables us to design from the perspective of a beginner and tailor the experience to where they’re at in their learning journey,” Keating says.

First-time competitor Muhammad Ali, a freshman computer science major, was completely new to cyber competitions. He shunned “blue team” or cyber defense activities, preferring to work on “red team” or cyberattack skills. Despite an obvious interest and acumen in cybersecurity — he says he hacked into his dad’s computer at the age of 9 — he says he didn’t think he had the skills to participate.

That all changed after his first experience with Horse Plinko.

“It’s a different story when you’re tasked against a whole squad of live red team hackers trying everything to take your services down,” Ali says. “It’s a lot of fun.”

He and his team placed second at the competition. In addition, he’s now scheduled to compete at two out-of-state cyber competitions next month.

“I suffer from imposter syndrome where I feel as if I’m not actually good enough for cybersecurity,” says Ali. “Surprisingly a lot of people do. UCF has a great community that has instilled not just self-confidence but acceptance for myself.”

Ali adds that he has every intention of participating in Horse Plinko again as an attacker on the red team.

“I never thought I’d enjoy Horse Plinko this much,” he says. “I am 100% doing this again next year. If you’re afraid of ‘blue teaming’, or [are] new to cybersecurity, Horse Plinko is the best place to get first-hand experience.”